Auditors have to continue doing their job of auditing, but with the pandemic, audits now are rarely on-site. Many auditing firms are using remote technology to conduct audits, and companies are either forwarding files electronically, using cloud-based portals or meeting with their auditors over technology meeting platforms such as zoom and/or teams.

There are risks associated with moving audits from in-person reviews on-site in conference rooms to using remote meeting technology or cloud-based products. Those risks, to name a few, include the potential transmission of highly sensitive or personal information via insecure email, the ability to take screen shots or record technology sessions such as zoom and/or teams, and the capture of information electronically that was never captured before, and the storage and potential of access to highly sensitive information or personal information by cloud vendors.

In assessing these risks, companies may wish to consider redacting sensitive information before pdf’ing or emailing documents to auditing firms, sending all sensitive information using encryption software, no allowing any screen shots, photographs or recording to take place on zoom and/or teams calls if sensitive information is being shared, and performing due diligence on cloud-based software that auditing firms propose to use, including privacy and security measures taken by the cloud-based vendor and what access the vendor has to company data.

Finally, whether audits are completed in person or remotely, review and consideration of requiring contractual language to include data privacy and security, indemnification and responsibilities regarding data loss and/or unauthorized access is an important risk management tool in the event that a security incident occurs.

Photo of Linn Foster Freedman Linn Foster Freedman

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She is a member of the Business Litigation Group and the Financial Services Cyber-Compliance Team, and chairs the firm’s Data Privacy and Security and Artificial Intelligence Teams. Linn focuses her…

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She is a member of the Business Litigation Group and the Financial Services Cyber-Compliance Team, and chairs the firm’s Data Privacy and Security and Artificial Intelligence Teams. Linn focuses her practice on compliance with all state and federal privacy and security laws and regulations. She counsels a range of public and private clients from industries such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine and charitable organizations, on state and federal data privacy and security investigations, as well as emergency data breach response and mitigation. Linn is an Adjunct Professor of the Practice of Cybersecurity at Brown University and an Adjunct Professor of Law at Roger Williams University School of Law.  Prior to joining the firm, Linn served as assistant attorney general and deputy chief of the Civil Division of the Attorney General’s Office for the State of Rhode Island. She earned her J.D. from Loyola University School of Law and her B.A., with honors, in American Studies from Newcomb College of Tulane University. She is admitted to practice law in Massachusetts and Rhode Island. Read her full rc.com bio here.